KYC Update SMS Link Scam
A text says your KYC has expired and your account will be blocked today. The link opens a fake form that steals your card, OTP and PIN.
You get a text that looks like it comes from your bank or wallet. It says your KYC is incomplete and the account will be frozen by midnight unless you tap a link. The link opens a page that copies the real bank's colours and logo. It asks for your customer ID, card number, expiry date and the OTP that arrives next. Nothing about it is a real KYC update. It is a form built to collect enough details to empty your account within minutes.
How the scam works
The scammer buys or copies a bulk SMS service and sends the same text to lakhs of numbers. The message uses the name of a large bank because most people have an account with one of them. The sender name is often a random mobile number or a header that only resembles the real one. Nobody has checked whether you even bank there. They only need a few people to believe it.
The text gives a short deadline such as today, tonight or two hours. It says the account will be blocked, debit cards will stop working and salary may not arrive. That fear is the whole trick. A person who is worried about losing access to money does not stop to look at the web address. The link is usually a shortened URL or a domain with extra words, hyphens or an odd ending.
On the fake page you type your card number, expiry, CVV and mobile number. The scammer then tries a real payment or login on the real bank at the same moment. The bank sends a real OTP to you. The fake page asks you to enter it as a 'verification code'. The moment you do, the scammer completes the transaction. Some pages also ask for your UPI PIN or net banking password.
An example of what you may see
Example message (invented): 'Dear customer, your account KYC has expired. Your account will be blocked today. Update immediately at bit.ly/xxxx-kyc and enter your card details and the OTP you receive. Ignore this and your services will stop. Team Customer Care.' Notice the shortened link, the threat of blocking, the request for card details and the OTP. A real bank never collects card details or OTPs through a link in a text message.
This example is written for illustration. Real messages change their wording, names and links all the time.
Red flags
- It threatens to block the account today.
- The link is shortened or the domain is not the bank's exact address.
- It asks for card number, CVV, PIN or OTP on a web form.
- The greeting is 'Dear customer' with no name or last digits.
- The sender is a plain mobile number, not a header you recognise.
- It gives no branch, no reference and no way to check except the link.
What to do right now
- Do not tap the link or reply to the message.
- Open the bank's own app, which you installed from the official store, and look for a KYC notice there.
- If you want to check, call the number printed on your debit card or passbook.
- Report the number to the Sanchar Saathi Chakshu facility.
- Forward the text to a family member so they know this wording.
If you already paid or shared a code
- Call 1930 at once and tell them the card or account details you entered.
- Ask your bank, through the number on your card, to block the card and freeze net banking.
- File a complaint at cybercrime.gov.in with screenshots of the text and the page.
- Change your net banking password and UPI PIN from the official app.
National Cyber Crime Helpline: 1930. Report online at cybercrime.gov.in. Do it fast: the sooner your bank is told, the better the chance that money can be held.
Where this scam shows up
Read how it looks on each channel:
How Safeavio helps
Safeavio Sentinel lets you paste or share the text and gives a plain verdict with reasons such as urgency, a threat and a request for OTP or card details. The link check looks at the address for lookalike domains and shortened links before you open it. It works only on text and links you give it, so it cannot read your inbox on its own. It also cannot recover money already sent, so use it before you tap.
Check it before you tap or pay
Safeavio Sentinel is a made-in-India Android app: paste a message or link, or scan a QR code, and get a plain verdict with the reasons. It helps you spot a scam; it does not promise to stop every one.
Download for AndroidWhat the app does
Google Play listing: coming soon. Today the signed APK is on safeavio.com/download. Android 7.0 or later.
Questions people ask
Does my bank really send KYC update links by SMS?
Banks may send reminders, but a genuine one never asks you to enter card numbers, PIN or OTP on a page opened from a text. If you are unsure, open the bank's official app or visit a branch. Do not use the link in the message to check.
The text has my bank's name. Does that prove it is real?
No. Anyone can type any name in a message. Scammers send to everyone and hope some recipients bank there. A real message from a bank is checked inside its own app, not by trusting the name written in the text.
I tapped the link but entered nothing. Am I safe?
Probably, but close the page and clear that browser tab. Do not enter anything later. If you did enter any detail, or a download started, treat it as a leak and call your bank right away.